The vulnerability of Hitachi Vantara Pentaho Business Analytics Server lies in its improper handling of insufficient permissions or privileges, allowing a malicious actor to trigger a service failure.

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server lies in the improper handling of insufficient permissions or privileges. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

Cross-site Scripting (XSS)

leantime/leantime is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper handling of SVG uploads which allows an attacker to inject malicious scripts and potentially redirect users to malicious websites by uploading specially crafted SVG files...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from not properly handling queue merges that have been set up...

Tenda AC18 Stack Overflow Vulnerability

Tenda AC18 is a wireless router manufactured by Tenda. A stack overflow vulnerability exists in the formSetSafeWanWebMan function in Tenda AC18 version V15.03.05.05, which stems from improper handling of the remoteIp parameter. An attacker can exploit this vulnerability to remotely execute...

CVE-2023-20582

Improper handling of invalid nested page table entries in the IOMMU may allow a privileged attacker to induce page table entry PTE faults to bypass RMP checks in SEV-SNP, potentially leading to a loss of guest memory integrity...

CVE-2022-4851

Improper Handling of Values in GitHub repository usememos/memos prior to 0.9.1...

Class Pollution

Django-Unicorn is vulnerable to Class Pollution. The vulnerability is due to improper handling of component requests due to the setpropertyvalue function allowing remote users to manipulate its parameters, leading to arbitrary changes in the Python runtime, enabling XSS, DoS, and authentication...

CVE-2024-49420

Improper handling of responses in GamingHub prior to version 6.1.04.6 in Korea, 7.1.03.7 in Global allows remote attackers to launch arbitrary activity...

CVE-2024-6868

mudler/LocalAI version 2.17.1 allows for arbitrary file write due to improper handling of automatic archive extraction. When model configurations specify additional files as archives e.g., .tar, these archives are automatically extracted after downloading. This behavior can be exploited to perfor...

Sensitive Information Disclosure

github.com/argoproj/argo-cd is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper handling of invalid Kubernetes Secret resources, allowing secret values to be exposed in error messages and the diff view. An attacker with write access to the repository can commit...

Unauthorized File Access

snowflake.data is vulnerable to Unauthorized File Access. The vulnerability is due to improper file handling, where downloaded files are temporarily stored in a world-readable local directory, allows unauthorized users on the same machine to access the files...

WordPress plugin Contest Gallery SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

WordPress plugin BP Email Assign Templates 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-23930 Pioneer DMH-WT7600NEX Media Service Improper Handling of Exceptional Conditions

This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Pioneer DMH-WT7600NEX devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Media service, which listens on TCP port 42000...

Arbitrary Code Execution

ASTEVAL is vulnerable to Arbitrary Code Execution. The vulnerability is due to improper handling of FormattedValue AST nodes due to the use of Python's str.format method, allowing attackers to bypass restrictions and execute arbitrary code...

Remote Code Execution (RCE)

Rasa is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper handling of maliciously crafted models in Rasa, which allows an attacker to load a model remotely into a Rasa instance if certain security configurations are not in place...

Cross-Site Request Forgery (CSRF)

typo3/cms-form is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to improper handling of state-changing actions in downstream components, which incorrectly accept submissions via HTTP GET requests instead of enforcing the correct HTTP method. Misconfigured settings, such ...

Rsync: heap buffer overflow in rsync due to improper checksum length handling

...

Credentials Exposure

github.com/git-lfs/git-lfs is vulnerable to Credential Exposure. The vulnerability is due to improper handling of URL-encoded control characters in Git LFS, which passes portions of a host's URL containing embedded line-ending control characters e.g., LF or CR to the git-credential command withou...

The vulnerability of the Git-based software platform for collaborative code development on GitLab EE/CE arises from improper handling of user actions, allowing unauthorized access to protected information by attackers.

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE/CE is related to improper management of user actions. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...